CVE-2025-40089

Vulnerability

Overview

CVE-2025-40089 is a NULL pointer dereference vulnerability in the Linux kernel's CXL (Compute Express Link) subsystem. The bug resides in the cxl_feature_info() function within the cxl_core module. When the CXL EDAC driver calls this function to retrieve feature information, the function does not check whether the cxlfs pointer is NULL before dereferencing it. If the hardware does not support CXL Features, cxlfs may be passed as NULL, leading to a kernel NULL pointer dereference and an Oops [1].

Exploitation

An attacker with local access and the ability to trigger the CXL EDAC driver's interaction with hardware that lacks CXL Features support can cause the kernel to crash. The crash manifests as a BUG with a NULL pointer dereference at address 0x0000000000000008, as shown in the kernel log [1]. No special privileges beyond the ability to load or trigger the CXL EDAC driver are required, but the attack surface is limited to systems with CXL hardware that does not support the Features capability.

Impact

Successful exploitation results in a denial of service (system crash) due to a kernel panic. The vulnerability does not allow for privilege escalation or data corruption, but it can cause system instability and downtime.

Mitigation

The fix adds a check for cxlfs before dereferencing it and returns -EOPNOTSUPP if no CXL Features support is detected. The patch has been applied to the Linux kernel stable tree [1]. Users should update their kernel to a version containing this fix.